It appears that my watchdog timer is running during interrupts that are handled by the SoftDevice and do not cause a return from sd_app_evt_wait. This is described in the answer to this question and means I am sometimes unable to feed the watchdog before it triggers a reset.
I am looking at using WFE instead of sd_app_evt_wait as a solution, but a lot of comments in other questions say to use sd_app_evt_wait when you are using the SoftDevice. It is not clear to me whether this is strictly required or not.
For example, this question's answer says:
It is not recommended to do that. The SD has its own housekeeping to do. sd_app_evt_wait is very reliable. If you do your approach you will just leave a bunch of stuff on that should be asleep.
But he does not give a source for this information.
Furthermore, an answer to this question says:
If I had to guess, I think Nordic has added some internal state-saving and safeties that keep the CPU awake and ready if some timing critical radio operation is about to occur.
A guess that is responded to affirmatively by Stefan Birnir Sverrisson.
I am hoping someone can tell me if I will break something if I decide to use WFE.
I should mention that the particular project that has this watchdog timer issue uses the nRF51 and version 12.3.0 of the SDK.